internet-facing-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerability

Progress ShareFile Storage Zones Controller Flaws Enable Unauthorized Access and RCE

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Apr 2, 2026

Progress disclosed two high-severity vulnerabilities in Customer Managed ShareFile Storage Zones Controller (SZC) that could expose organizations to unauthorized access and remote code execution. CVE-2026-2699 allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-284 and CWE-698.

A second issue, CVE-2026-2701, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a CVSS 8.8 rating (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is mapped to CWE-94, CWE-78, and CWE-434. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Apr 2, 2026

Apr 2, 20267mo ago
Progress releases ShareFile SZC fix in version 5.12.4
On 2026-04-02, Progress disclosed fixes for CVE-2026-2699 and CVE-2026-2701 in ShareFile Storage Zones Controller v5.12.4 and advised customers to upgrade or move to any unaffected v6 release. The company also said it had not received reports of active exploitation at the time of the notice.
Security Vulnerability Fix For ShareFile Storage Zones Controller 5.x (February 2026)
Apr 2, 20267mo ago
CVE records and vendor references are published for the ShareFile SZC flaws
On 2026-04-02, public CVE entries were published for both vulnerabilities with high-severity CVSS v3.1 scores, CWE mappings, and vendor/security advisory references. The CVE-2026-2699 record was also updated the same day to add a WatchTowr Labs reference.
Apr 2, 20267mo ago
Progress receives reports for ShareFile SZC vulnerabilities CVE-2026-2699 and CVE-2026-2701
On 2026-04-02, Progress received vulnerability reports affecting Customer Managed ShareFile Storage Zones Controller. CVE-2026-2699 allows unauthenticated access to restricted configuration pages with possible configuration changes and remote code execution, while CVE-2026-2701 allows an authenticated user to upload and execute a malicious file on the server.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Execution After Redirect Authentication Bypass in Progress ShareFile Storage Zones Controller (CVE-2026-2699)Remote Code Execution in Progress ShareFile Storage Zones Controller File Upload Handling (CVE-2026-2701)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 2, 2026

CVE-2026-2699 - EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)Open source ↗

Cvefeed High SeverityAdvisories · Apr 2, 2026

CVE-2026-2701 - RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)Open source ↗

Sharefile DocsNews · Apr 2, 2026

Security Vulnerability Fix For ShareFile Storage Zones Controller 5.x (February 2026)Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Progress ShareFile Storage Zones Controller Flaws Enable Unauthorized Access and RCE

How this story unfolded

Progress releases ShareFile SZC fix in version 5.12.4

CVE records and vendor references are published for the ShareFile SZC flaws

Progress receives reports for ShareFile SZC vulnerabilities CVE-2026-2699 and CVE-2026-2701

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Progress ShareFile Flaws Enable Pre-Auth RCE on Storage Zone Controller

Progress ShareFile Storage Zones Controller Zero-Day Path Traversal Patched

Progress Tells ShareFile Customers to Shut Down On-Prem Storage Zone Controllers

Progress ShareFile Storage Zones Controller Flaws Enable Unauthorized Access and RCE

How this story unfolded

Progress releases ShareFile SZC fix in version 5.12.4

CVE records and vendor references are published for the ShareFile SZC flaws

Progress receives reports for ShareFile SZC vulnerabilities CVE-2026-2699 and CVE-2026-2701

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Progress ShareFile Flaws Enable Pre-Auth RCE on Storage Zone Controller

Progress ShareFile Storage Zones Controller Zero-Day Path Traversal Patched

Progress Tells ShareFile Customers to Shut Down On-Prem Storage Zone Controllers